CVE-2022-1218

CVE-2022-1218: Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting

Vendor Unknown

Product Domain Replace

Weakness CWE-79 · XSS

Published May 23, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

Key dates

02Disclosure timeline

May 23, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1218 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-28836 Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views CVE-2021-1490 Cisco Web Security Appliance Cross-Site Scripting Vulnerability CVE-2026-57330 WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability CVE-2023-48513 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2023-26537 WordPress WP No External Links Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)